Skip to content

Commit 81d2944

Browse files
KagashinoKagashino
authored
Merge pull request #688 from tencentcloudstack/feat/tke-auth-attachment
feat: tke - support auth attachment
2 parents 0149916 + f437211 commit 81d2944

8 files changed

+452
-7
lines changed

‎tencentcloud/extension_tke.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,3 +103,7 @@ type OverrideSettings struct {
103103
const (
104104
DefaultDesiredPodNum = 0
105105
)
106+
107+
const (
108+
DefaultAuthenticationOptionsIssuer = "https://kubernetes.default.svc.cluster.local"
109+
)

‎tencentcloud/provider.go

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,7 @@ Tencent Kubernetes Engine(TKE)
325325
tencentcloud_kubernetes_cluster_attachment
326326
tencentcloud_kubernetes_node_pool
327327
tencentcloud_eks_cluster
328+
tencentcloud_kubernetes_auth_attachment
328329
329330
MongoDB
330331
Data Source
@@ -855,6 +856,7 @@ func Provider() terraform.ResourceProvider {
855856
"tencentcloud_container_cluster_instance": resourceTencentCloudContainerClusterInstance(),
856857
"tencentcloud_kubernetes_cluster": resourceTencentCloudTkeCluster(),
857858
"tencentcloud_eks_cluster": resourceTencentcloudEksCluster(),
859+
"tencentcloud_kubernetes_auth_attachment": resourceTencentCloudTKEAuthAttachment(),
858860
"tencentcloud_kubernetes_as_scaling_group": ResourceTencentCloudKubernetesAsScalingGroup(),
859861
"tencentcloud_kubernetes_scale_worker": resourceTencentCloudTkeScaleWorker(),
860862
"tencentcloud_kubernetes_cluster_attachment": resourceTencentCloudTkeClusterAttachment(),

‎tencentcloud/resource_tc_kubernetes_auth_attachment.go

Lines changed: 218 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,218 @@
1+
/**
2+
Provide a resource to configure kubernetes cluster authentication info.
3+
4+
~> **NOTE:** Only avaliable for cluster version >= 1.20
5+
6+
Example Usage
7+
8+
```hcl
9+
variable "availability_zone" {
10+
default = "ap-guangzhou-3"
11+
}
12+
13+
variable "cluster_cidr" {
14+
default = "172.16.0.0/16"
15+
}
16+
17+
variable "default_instance_type" {
18+
default = "S1.SMALL1"
19+
}
20+
21+
data "tencentcloud_images" "default" {
22+
image_type = ["PUBLIC_IMAGE"]
23+
os_name = "centos"
24+
}
25+
26+
data "tencentcloud_vpc_subnets" "vpc" {
27+
is_default = true
28+
availability_zone = var.availability_zone
29+
}
30+
31+
resource "tencentcloud_kubernetes_cluster" "managed_cluster" {
32+
vpc_id = data.tencentcloud_vpc_subnets.vpc.instance_list.0.vpc_id
33+
cluster_cidr = "10.31.0.0/16"
34+
cluster_max_pod_num = 32
35+
cluster_name = "keep"
36+
cluster_desc = "test cluster desc"
37+
cluster_version = "1.20.6"
38+
cluster_max_service_num = 32
39+
40+
worker_config {
41+
count = 1
42+
availability_zone = var.availability_zone
43+
instance_type = var.default_instance_type
44+
system_disk_type = "CLOUD_SSD"
45+
system_disk_size = 60
46+
internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR"
47+
internet_max_bandwidth_out = 100
48+
public_ip_assigned = true
49+
subnet_id = data.tencentcloud_vpc_subnets.vpc.instance_list.0.subnet_id
50+
51+
data_disk {
52+
disk_type = "CLOUD_PREMIUM"
53+
disk_size = 50
54+
}
55+
56+
enhanced_security_service = false
57+
enhanced_monitor_service = false
58+
user_data = "dGVzdA=="
59+
password = "ZZXXccvv1212"
60+
}
61+
62+
cluster_deploy_type = "MANAGED_CLUSTER"
63+
}
64+
65+
resource "tencentcloud_kubernetes_auth_attachment" "test_auth_attach" {
66+
cluster_id = tencentcloud_kubernetes_cluster.managed_cluster.id
67+
jwks_uri = "https://${tencentcloud_kubernetes_cluster.managed_cluster.id}.ccs.tencent-cloud.com/openid/v1/jwks"
68+
issuer = "https://${tencentcloud_kubernetes_cluster.managed_cluster.id}.ccs.tencent-cloud.com"
69+
auto_create_discovery_anonymous_auth = true
70+
}
71+
```
72+
*/
73+
package tencentcloud
74+
75+
import (
76+
"context"
77+
"github.com/hashicorp/terraform-plugin-sdk/helper/schema"
78+
tke "github.com/tencentcloud/tencentcloud-sdk-go/tencentcloud/tke/v20180525"
79+
"github.com/tencentcloudstack/terraform-provider-tencentcloud/tencentcloud/internal/helper"
80+
)
81+
82+
func resourceTencentCloudTKEAuthAttachment() *schema.Resource {
83+
return &schema.Resource{
84+
Schema: map[string]*schema.Schema{
85+
"cluster_id": {
86+
Type: schema.TypeString,
87+
Required: true,
88+
Description: "ID of clusters.",
89+
},
90+
"issuer": {
91+
Type: schema.TypeString,
92+
Required: true,
93+
Description: "Specify service-account-issuer.",
94+
},
95+
"jwks_uri": {
96+
Type: schema.TypeString,
97+
Optional: true,
98+
Description: "Specify service-account-jwks-uri.",
99+
},
100+
"auto_create_discovery_anonymous_auth": {
101+
Type: schema.TypeBool,
102+
Optional: true,
103+
Default: false,
104+
Description: "If set to `true`, the rbac rule will be created automatically which allow anonymous user to access '/.well-known/openid-configuration' and '/openid/v1/jwks'.",
105+
},
106+
},
107+
Create: resourceTencentCloudTKEAuthAttachmentCreate,
108+
Update: resourceTencentCloudTKEAuthAttachmentUpdate,
109+
Read: resourceTencentCloudTKEAuthAttachmentRead,
110+
Delete: resourceTencentCloudTKEAuthAttachmentDelete,
111+
}
112+
}
113+
114+
func resourceTencentCloudTKEAuthAttachmentCreate(d *schema.ResourceData, meta interface{}) error {
115+
defer logElapsed("resource.resource_tc_kubernetes_auth_attachment.create")()
116+
logId := getLogId(contextNil)
117+
ctx := context.WithValue(context.TODO(), logIdKey, logId)
118+
id := d.Get("cluster_id").(string)
119+
120+
service := TkeService{client: meta.(*TencentCloudClient).apiV3Conn}
121+
request := tke.NewModifyClusterAuthenticationOptionsRequest()
122+
request.ClusterId = &id
123+
request.ServiceAccounts = &tke.ServiceAccountAuthenticationOptions{
124+
Issuer: helper.String(d.Get("issuer").(string)),
125+
}
126+
127+
if v, ok := d.GetOk("jwks_uri"); ok {
128+
request.ServiceAccounts.JWKSURI = helper.String(v.(string))
129+
}
130+
131+
if v, ok := d.GetOk("auto_create_discovery_anonymous_auth"); ok {
132+
request.ServiceAccounts.AutoCreateDiscoveryAnonymousAuth = helper.Bool(v.(bool))
133+
}
134+
135+
if err := service.ModifyClusterAuthenticationOptions(ctx, request); err != nil {
136+
return err
137+
}
138+
139+
d.SetId(id)
140+
return resourceTencentCloudTKEAuthAttachmentRead(d, meta)
141+
}
142+
func resourceTencentCloudTKEAuthAttachmentRead(d *schema.ResourceData, meta interface{}) error {
143+
defer logElapsed("resource.resource_tc_kubernetes_auth_attachment.read")()
144+
logId := getLogId(contextNil)
145+
ctx := context.WithValue(context.TODO(), logIdKey, logId)
146+
147+
id := d.Id()
148+
149+
service := TkeService{client: meta.(*TencentCloudClient).apiV3Conn}
150+
info, err := service.WaitForAuthenticationOptionsUpdateSuccess(ctx, id)
151+
152+
if err != nil {
153+
d.SetId("")
154+
return err
155+
}
156+
157+
d.SetId(id)
158+
159+
_ = d.Set("jwks_uri", info.JWKSURI)
160+
_ = d.Set("issuer", info.Issuer)
161+
162+
return nil
163+
}
164+
165+
func resourceTencentCloudTKEAuthAttachmentUpdate(d *schema.ResourceData, meta interface{}) error {
166+
defer logElapsed("resource.resource_tc_kubernetes_auth_attachment.update")()
167+
logId := getLogId(contextNil)
168+
ctx := context.WithValue(context.TODO(), logIdKey, logId)
169+
170+
id := d.Id()
171+
172+
service := TkeService{client: meta.(*TencentCloudClient).apiV3Conn}
173+
request := tke.NewModifyClusterAuthenticationOptionsRequest()
174+
request.ClusterId = &id
175+
request.ServiceAccounts = &tke.ServiceAccountAuthenticationOptions{}
176+
177+
if d.HasChange("jwks_uri") {
178+
request.ServiceAccounts.JWKSURI = helper.String(d.Get("jwks_uri").(string))
179+
}
180+
if d.HasChange("issuer") {
181+
issuer := d.Get("issuer").(string)
182+
request.ServiceAccounts.Issuer = helper.String(issuer)
183+
}
184+
185+
if err := service.ModifyClusterAuthenticationOptions(ctx, request); err != nil {
186+
return err
187+
}
188+
189+
return resourceTencentCloudTKEAuthAttachmentRead(d, meta)
190+
}
191+
192+
func resourceTencentCloudTKEAuthAttachmentDelete(d *schema.ResourceData, meta interface{}) error {
193+
defer logElapsed("resource.resource_tc_kubernetes_auth_attachment.delete")()
194+
logId := getLogId(contextNil)
195+
ctx := context.WithValue(context.TODO(), logIdKey, logId)
196+
197+
id := d.Id()
198+
199+
service := TkeService{client: meta.(*TencentCloudClient).apiV3Conn}
200+
request := tke.NewModifyClusterAuthenticationOptionsRequest()
201+
request.ClusterId = &id
202+
request.ServiceAccounts = &tke.ServiceAccountAuthenticationOptions{
203+
JWKSURI: helper.String(""),
204+
Issuer: helper.String(DefaultAuthenticationOptionsIssuer),
205+
}
206+
207+
if err := service.ModifyClusterAuthenticationOptions(ctx, request); err != nil {
208+
return err
209+
}
210+
211+
_, err := service.WaitForAuthenticationOptionsUpdateSuccess(ctx, id)
212+
213+
if err != nil {
214+
return err
215+
}
216+
217+
return nil
218+
}

‎tencentcloud/resource_tc_kubernetes_auth_attachment_test.go

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
package tencentcloud
2+
3+
import (
4+
"testing"
5+
6+
"github.com/hashicorp/terraform-plugin-sdk/helper/resource"
7+
)
8+
9+
func TestAccTencentCloudTkeAuthAttachResource(t *testing.T) {
10+
resource.Test(t, resource.TestCase{
11+
PreCheck: func() { testAccPreCheck(t) },
12+
Providers: testAccProviders,
13+
Steps: []resource.TestStep{
14+
{
15+
Config: testAccTkeAuthAttach(),
16+
Check: resource.ComposeTestCheckFunc(
17+
resource.TestCheckResourceAttrSet("resource_tc_kubernetes_auth_attachment.test_auth_attach", "cluster_id"),
18+
resource.TestCheckResourceAttrSet("resource_tc_kubernetes_auth_attachment.test_auth_attach", "issuer"),
19+
resource.TestCheckResourceAttrSet("resource_tc_kubernetes_auth_attachment.test_auth_attach", "jwks_uri"),
20+
resource.TestCheckResourceAttr("resource_tc_kubernetes_auth_attachment.test_auth_attach", "auto_create_discovery_anonymous_auth", "true"),
21+
),
22+
},
23+
},
24+
})
25+
}
26+
27+
func testAccTkeAuthAttach() string {
28+
return `
29+
variable "availability_zone" {
30+
default = "ap-guangzhou-3"
31+
}
32+
33+
variable "cluster_cidr" {
34+
default = "172.16.0.0/16"
35+
}
36+
37+
variable "default_instance_type" {
38+
default = "S1.SMALL1"
39+
}
40+
41+
data "tencentcloud_images" "default" {
42+
image_type = ["PUBLIC_IMAGE"]
43+
os_name = "centos"
44+
}
45+
46+
47+
data "tencentcloud_vpc_subnets" "vpc" {
48+
is_default = true
49+
availability_zone = var.availability_zone
50+
}
51+
52+
resource "tencentcloud_kubernetes_cluster" "managed_cluster" {
53+
vpc_id = data.tencentcloud_vpc_subnets.vpc.instance_list.0.vpc_id
54+
cluster_cidr = "10.31.0.0/16"
55+
cluster_max_pod_num = 32
56+
cluster_name = "keep"
57+
cluster_desc = "test cluster desc"
58+
cluster_version = "1.20.6"
59+
cluster_max_service_num = 32
60+
61+
worker_config {
62+
count = 1
63+
availability_zone = var.availability_zone
64+
instance_type = var.default_instance_type
65+
system_disk_type = "CLOUD_SSD"
66+
system_disk_size = 60
67+
internet_charge_type = "TRAFFIC_POSTPAID_BY_HOUR"
68+
internet_max_bandwidth_out = 100
69+
public_ip_assigned = true
70+
subnet_id = data.tencentcloud_vpc_subnets.vpc.instance_list.0.subnet_id
71+
72+
data_disk {
73+
disk_type = "CLOUD_PREMIUM"
74+
disk_size = 50
75+
}
76+
77+
enhanced_security_service = false
78+
enhanced_monitor_service = false
79+
user_data = "dGVzdA=="
80+
password = "ZZXXccvv1212"
81+
}
82+
83+
cluster_deploy_type = "MANAGED_CLUSTER"
84+
}
85+
86+
resource "tencentcloud_kubernetes_auth_attachment" "test_auth_attach" {
87+
cluster_id = tencentcloud_kubernetes_cluster.managed_cluster.id
88+
jwks_uri = "https://${tencentcloud_kubernetes_cluster.managed_cluster.id}.ccs.tencent-cloud.com/openid/v1/jwks"
89+
issuer = "https://${tencentcloud_kubernetes_cluster.managed_cluster.id}.ccs.tencent-cloud.com"
90+
auto_create_discovery_anonymous_auth = true
91+
}
92+
`
93+
}

‎tencentcloud/resource_tc_tcr_vpc_attachment.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -61,16 +61,16 @@ func resourceTencentCloudTcrVpcAttachment() *schema.Resource {
6161
Description: "ID of subnet.",
6262
},
6363
"region_id": {
64-
Type: schema.TypeInt,
65-
Optional: true,
64+
Type: schema.TypeInt,
65+
Optional: true,
6666
ConflictsWith: []string{"region_name"},
67-
Description: "ID of region. Conflict with region_name, can not be set at the same time.",
67+
Description: "ID of region. Conflict with region_name, can not be set at the same time.",
6868
},
6969
"region_name": {
70-
Type: schema.TypeString,
71-
Optional: true,
70+
Type: schema.TypeString,
71+
Optional: true,
7272
ConflictsWith: []string{"region_id"},
73-
Description: "Name of region. Conflict with region_id, can not be set at the same time.",
73+
Description: "Name of region. Conflict with region_id, can not be set at the same time.",
7474
},
7575
"enable_public_domain_dns": {
7676
Type: schema.TypeBool,

0 commit comments

Comments
 (0)